feat(deps): gate staged QPK pin auto-advance

[Pigbibi]

Summary

• Auto-queue only the trusted, single-file staged QPK_PIN PR after its CI succeeds.
• Require same-repo branch, known automation author, exact title, valid SHA, and main-history ancestry before merge eligibility.
• Preserve strategy → consumer → aggregate downstream PR staging; no deployment or runtime invocation.
• Pin the remaining downstream PR action by commit SHA.

Validation

• Manually invoked all cases in tests/test_update_qpk_pin_workflow.py because pytest is unavailable on this VPS.
• Ran git diff --check.

Remote CI will run the repository full test and actionlint checks.